fapico2
The F**king Authenticator. Your passkeys, PGP keys and 2FA tokens — on hardware you own.
fapico2 turns a ~$5 Raspberry Pi Pico 2 into a multi-applet hardware authenticator: FIDO2 passkeys, OpenPGP 3.4, OATH (TOTP/HOTP) and YubiKey-protocol OTP served by one firmware, one binary, over one USB composite device. No vendor account, no cloud, no subscription. Written in Rust, licensed AGPLv3 — build it from source or download the prebuilt image.
Read this first
fapico2 is experimental. No audit outside this project has looked at the code, the RP2350 carries no secure element, and what stands between a lab and your keys is the sealing design plus whatever hardening you have burned into the board. Do not put a credential on it whose loss you could not survive. The threat model and security pages name what the chip cannot stop — read them before the first enrolment, not after the first incident.
Keys never touch an online machine
- Generated on the device, and they stay there. Every key comes from the RP2350's hardware TRNG and every signature happens on the chip. Nothing crypto-related ever leaves the board.
- Sealed at rest. Everything is AEAD-encrypted under a root key derived from a one-way-fused OTP row plus the chip's own identity. A flash dump lifted off your board is inert somewhere else — recovering the root key from the chip itself takes physical possession and very sophisticated lab methods, not a USB cable. The same reasoning that keeps bitcoin keys off internet-connected machines applies to the keys that guard your email, your code and your accounts.
- No network. The device build has no network stack at all. There is no channel to exfiltrate through, because there is no channel.
- No one else's copy. A passkey synced to a phone vendor's cloud lives on every device signed into that account, and you trust the vendor's sync to keep it. A resident passkey on fapico2 exists on one board you own.
- Nothing to revoke, no one to trust. No account to suspend, no server to breach, subpoena or shut down. The board answers to you and works as long as the board does.
What it is for
Tired of opening an app and filling in OTPs on every site? Tired of passwords a database leak takes away from you?
Then put them on a board you own: tap it, type your PIN once, and you are in. No app to open, no six digits to copy, no password to remember. Each applet below replaces a habit that leaks — six of the everyday ones.
Passkey logins
Register once in any browser; from then on, login is a touch and the PIN. Room for 848 resident passkeys — a YubiKey 5 holds 100.
Passwordless SSH
Resident -sk keys with verify-required: the private half never touches a disk. Walkthrough.
Linux login
The board answers PAM at the login prompt — a stolen password alone gets nobody in. Walkthrough.
Encrypted to the recipient
OpenPGP 3.4 signs and decrypts from the card: mail and files sealed for one reader, not for the channel. Walkthrough.
Disk encryption gate
The hmac-secret extension hands LUKS its unlock secret only while the board is present and touched. Walkthrough.
Second factor, in your pocket
TOTP and HOTP codes computed on the board, read through Yubico Authenticator — on the laptop or on your phone over a USB cable. The phone holds none of them.
What it does
| App | What you use it for | Transport | Verified with |
|---|---|---|---|
| FIDO2 | passkeys, WebAuthn, SSH (-sk), Linux login | CTAP-HID | Chrome, python-fido2 2.2.1, ykman |
| OpenPGP 3.4 | PGP signing/encryption, SSH auth | CCID | gpg / scdaemon 2.4.4 |
| OATH (YKOATH) | TOTP/HOTP codes | CCID | ykman, Yubico Authenticator |
| OTP | YubiKey-slot OTP | CCID | ykman otp |
| Management | device config, rescue surface | CCID | ykman, PicoForge |
| Nostr | BIP-340 event signing, NIP-44 encryption | vendor HID + CCID | fapico2 Nostr extension |
The board speaks dialects your machine already knows: browsers and ykman over CTAP-HID, GnuPG and Yubico Authenticator over CCID — and your phone talks to it over a USB OTG cable once it claims a Yubico identity. The first hour with the board: Using the device. Deeper walks: the how-tos for SSH and Linux login, end to end.
Capacity
- 848 resident passkeys — measured to refusal on hardware. For scale: a YubiKey 5 holds 100.
- 68 OATH credentials reserved in the key store.
- 8 Nostr identities — BIP-340 signing and NIP-44 encryption, through the browser extension: the applet.
One board replaces a drawer of tokens.
Getting started
The board: one Raspberry Pi Pico 2 (RP2350) — nothing else on the shopping list. What makes a board compatible.
The image: download the prebuilt fapico2.uf2 (sha256 in its release notes) or build from source.
The flash: hold BOOTSEL, plug the board in, copy the UF2 onto the RP2350 drive that mounts, and wait — re-enumeration can take up to a minute and that is normal.
The first login: FIDO2 works in any browser straight away. Linux/macOS only: OpenPGP and OATH need a one-time libccid allowlist edit.
See Getting Started for the full procedure.
Buy me a coffee
fapico2 is free software, built in the open. If it earned its keep, send sats: ⚡ eddieoz@sats4.life